﻿using System;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using DMS.Business;

namespace DMS.BO.Security.Principal
{
    [SuppressMessage("Microsoft.Performance", "CA1813:AvoidUnsealedAttributes",
        Justification =
            "Unsealed so that subclassed types can set properties in the default constructor or override our behavior.")
    ]
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
    public class AuthorizeAdminAttribute : AuthorizeAttribute
    {
        public DMSPermission Permission { get; set; }

        // This method must be thread-safe since it is called by the thread-safe OnCacheAuthorization() method.
        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            // call base method            
            bool result = base.AuthorizeCore(httpContext);
            // if base return true, check additional logic base on Permissions
            if (result)
            {
                //Kiem tra user da dang nhap hay chua
                if (httpContext.User.Identity.IsAuthenticated)
                {
                    //check quyen cua user
                    return PermissionUtility.HasPermission(Permission);
                }
            }

            return false;
        }
    }
}